fix #84: security headers were silently dropped (set pre-handler) #87

2026-09-09T15:54:16Z

poslop commented

2026-09-09 15:54:16 +00:00

Root cause of #84: the SecurityHeaders middleware set CSP/Referrer-Policy/nosniff AFTER the handler ran. Page handlers render templates which flush the response immediately, so the header mutations landed after WriteHeader and were silently discarded. The unit test passed because httptest.Recorder doesn't flush.

Fix: set the headers unconditionally BEFORE next.ServeHTTP. Safe on JSON/raw (CSP+nosniff+no-referrer on non-HTML bodies is harmless and desirable).

Live-verified: headers now present on /history, /{id}, /new in a local v0.2.1 build.

Root cause of #84: the SecurityHeaders middleware set CSP/Referrer-Policy/nosniff AFTER the handler ran. Page handlers render templates which flush the response immediately, so the header mutations landed after WriteHeader and were silently discarded. The unit test passed because httptest.Recorder doesn't flush. Fix: set the headers unconditionally BEFORE next.ServeHTTP. Safe on JSON/raw (CSP+nosniff+no-referrer on non-HTML bodies is harmless and desirable). Live-verified: headers now present on /history, /{id}, /new in a local v0.2.1 build.

poslop added 1 commit 2026-09-09 15:54:16 +00:00